feat(aws)!: generate 100% AWS Resource & Binding coverage

[sam-goodwin]

AWS resource-factory run — one PR, updated wave by wave until all phases (Serverless → ECS/Fargate → EKS → EC2 → long tail) are complete. Every wave is implemented and live-tested against real AWS by fleets of agents; every SDK gap found becomes a distilled patch (companion distilled PR per wave).

Status: the full workspace type-checks clean (bun tsc -b → 0 errors). Phases 1–5 plus the complete T2 deferred list (waves A–E) are implemented — every serverless, container, EKS, EC2, and long-tail service across ~120 AWS service dirs, with bindings, event sources, and Effect-first runtime functions, live-tested against real AWS. The final catalog tiering: 428 distilled modules → 122 implemented, 114 T2-deferred (on demand), 192 T3-out-of-scope (deprecated / data-only / vertical). The companion distilled PR carries every SDK improvement the run produced (Presign, Smithy hostPrefix, syntheticErrors, rest-xml fixes, paginator + schema patches).

Convergence: suite green + zero-orphan, twice consecutively

The nuke → full-suite → leak-census → fix-fleet loop (now codified in AGENTS.md) ran 12 iterations and terminated at its bar: two consecutive rounds (11 & 12) of 0 failed / 2692 passed with a zero-AWS-residue census — the suite provably deploys from a nuked account and leaves nothing behind. Runs settle at ~12 min wall-clock (--concurrency 96; unbounded saturates the single-process runner and fakes beforeAll timeouts).

Provider bugs the loop caught and fixed (each verified live):

• Amplify: create now observe-adopts an app a timed-out CreateApp actually made (new distilled-typed TimeoutException); rate-exceeded retries spread across the account throttle bucket, deletes retry it too
• EC2 VpcEndpoint: spurious modify-after-create (policy diff vs undefined → ResetPolicy racing propagation → stranded endpoint blocking VPC deletes), unretried NotFound race, delete not waiting for async ENI release
• Batch: wait-until-gone polls silently returned on budget expiry → engine deleted the service role mid-teardown → CEs wedged DISABLED+INVALID forever; polls fail loud + delete restores a minimal same-name role to unwedge; fresh creates recover from IAM-propagation INVALID (reap + bounded recreate)
• MediaPackageV2 / Deadline: parent deletes now reap children (stub list()s made real); ConflictException-forever leaks gone
• Polly: precreate persists deterministic identity so a mid-create crash can't orphan the lexicon
• Lambda: post-delete log-flush recreations are re-reaped in a bounded observe→delete loop instead of failing the whole destroy
• Census correctness: EC2 list() excludes default-VPC account furniture (test/AWS/DefaultVpc.ts recreates it as standing infra); nuke spares B2BI vended-log singletons

Default-pass coverage: 2692 live tests green; 375 gated (AWS_TEST_SLOW long-provisioning, cost/entitlement locks, external prerequisites like APNs/WABA/GitHub-OAuth, account-singletons) — each gated lifecycle keeps an ungated typed probe that runs green.

AWS test suite: green + zero-orphan guaranteed (tree type-clean)

Live-tested every AWS service against real AWS (memory-safe single-fork) and raised the bar for "green": a passing test must leave zero orphaned cloud resources.

• All ~204 tested services green (every AWS service dir with a test suite). Real failures fixed at the root; ~117 lifecycle tests skipIf-gated with the exact reason (cost / singleton / slow-provisioning / entitlement) plus ungated typed probes. Companion distilled patches: cloudfront Comment, rds validation errors, s3tables modifiedBy, wafv2 WAFUnavailableEntityException, s3 BucketHasAccessPointsAttached.
• Zero-orphan enforced + live-verified. Every test.provider body is wrapped in Effect.ensuring(scratch.destroy()); the gaps were out-of-band resources (adoption/import tests) and provider delete bugs. Fixed fleet-wide: deterministic names (no Math.random()/Date.now()), Effect.acquireRelease/ensuring cleanup with idempotent typed deletes, delete-if-exists pre-clean. After each suite an out-of-band AWS sweep asserts zero leftovers.
• Provider leaks fixed (every consumer hit these, not just tests):
  • Lambda Function delete now reaps the auto-created /aws/lambda/{name} log group (re-reap watch for the ~35s post-delete flush).
  • DynamoDB Table delete disables Contributor Insights and waits for the CloudWatch rules to clear before deleteTable (else they strand forever).
  • ECS Task delete hard-deletes deregistered task-definition revisions (deregister alone leaks an INACTIVE revision forever).
  • InternetMonitor / MWAAServerless / Deadline / Batch deletes reap the auto-created /aws/{service}/… CloudWatch log groups (same class as the Lambda bug — they survive their parent's deletion).
• nuke.sh hardened — it was targeting the alchemy-state-*/alchemy-assets-* buckets; now spares them and AWS-managed account resources (ServiceLinkedRole, LakeFormation, default-named singletons, DO-NOT-DELETE-*).
• The account-wide nuke is the acceptance test, run in a loop: its deletion list (by test-named resource) surfaces exactly which tests leaked, those get fixed + re-verified, repeat. It reduced the account 494 → 44 → 104 → 65 across rounds, converging to only documented-undeletable residue (BackupSearch terminal records ~7-day retention; 2 DynamoDB Contributor-Insights rules with no delete API; PaymentCrypto keys in scheduled deletion) plus AWS-managed defaults.
• Type-safety footgun fixed — a compound Effect.retry({ while }) predicate gets inferred as a type-predicate, collapses the error channel to unknown, and poisons the provider Layer type → a 600-error StackServices cascade across every test. Annotated : boolean.

Durable Functions + fleet-wide prop data-type audit (tree type-clean)

AWS.Lambda.DurableFunction — a code-first, replay-based orchestrator that is a durable Lambda Function (a wrapper of AWS.Lambda.Function, not a binding or a boolean prop; the base Function stays durability-agnostic and only carries an @internal durableConfig the wrapper sets at CreateFunction).

export class OrderFlow extends AWS.Lambda.DurableFunction<OrderFlow>()(
  "OrderFlow",
  Effect.gen(function* () {
    const putItem = yield* AWS.DynamoDB.PutItem(table);
    return (input: { orderId: string }) =>
      Effect.gen(function* () {
        const r = yield* Lambda.Durable.step("reserve", reserve(putItem, input), {
          retry: { limit: 3, delay: "5 seconds", backoff: "exponential" },
        });
        yield* Lambda.Durable.sleep("cooldown", "10 minutes"); // real suspend/resume
        return r;
      });
  }),
) {}

• Durable.step / Durable.sleep / Durable.waitForCallback mirror the Cloudflare Workflow vocabulary; the DurableExecutionInvocationInput envelope routes through the owned Lambda entrypoint like an event source (isDurableExecutionEvent predicate + fresh per-invocation Scope), driven by AWS's @aws/durable-execution-sdk-js behind an Effect-native DurableStep service.
• Determinism is type-enforced: the run body's requirement set excludes Credentials/Region, so the only path to I/O is an init-resolved binding client called inside Durable.step.
• Ungated typed probe (ResourceNotFoundException) green; full suspend/resume lifecycle verified green live (AWS_TEST_DURABLE=1, ~43s warm, Status: SUCCEEDED). The wrapper captures its own functionName Output unresolved (avoids a plan-time self-reference deadlock) and defers the durable-SDK import() to first invocation; durable functions reject unqualified invokes, so a version is published and invoked with a Qualifier.

Props/attributes data-type audit across 205 AWS services (174 files):

• 26 sensitive Props/Attributes are now Redacted.Redacted<string> (master/admin passwords, session keys, client secrets, LoRaWAN keys) — Redacted.value on write, Redacted.make on read, round-tripped through StateEncoding.
• 124 duration Props are now Duration.Input (callers write "1 hour" / Duration.hours(1)), each converted to the exact wire unit in its provider (seconds / millis / days / minutes / ISO-8601) with state-JSON normalization guards.

Documentation pass (dimensions 3 & 4) across ~200 services: resource @section/@example blocks with coherent cross-references (grounded in the test suites), field-level prop/attr docs, and — the key gap — a usage @example on every capability / event source / sink (bind + provide the impl layer + call the runtime client), fixing the "describes behavior, never shows usage" anti-pattern. bun docs:gen regenerates 1191 provider pages clean.

Next surface — runtime layers, Step Functions DSL, DB drivers (tree type-clean)

Building on 100% resource coverage, three design tracks (full designs in processes/AWS/design/) — all live-tested, bun tsc -b --force → 0.

• Runtime: makeBatchedSink engine + 6 Tier-1 sinks (DynamoDB/Firehose/CloudWatch/Logs/EventBridge/Timestream); SQS/Cognito event sources standardized onto Binding.Service. Breaking: sink In is now the raw distilled entry type with a typed error channel.
• DSL: a typed Effect-mirrored Step Functions program (Sfn.gen/retry/catchTag/forEach/all) compiling to ASL via StateMachine.fromProgram — the raw definition path stays first-class; simulate() local interpreter; ValidateStateMachineDefinition/TestState bindings. Plus a 12-service IAM PolicyDocument sweep + generated IamAction types.
• DB drivers: Runtime/ExecutionMemo (per-execution pool), Connection scaffolding + DbAuthToken SigV4 presign, AWS.SimpleDB full data plane (7 per-operation bindings — closes the zero-bindings gap), DSQL Connect+Drizzle e2e, RDS url+IAM-auth+VPC, Redshift Connect.

Bindings are 1:1 with IAM actions (one binding per operation via make{Service}Binding), not Read/Write splits.

T2 full-coverage push — final tail (wave E3, complete, tree type-clean)

The last 9 T2 services — combined gate bun tsc -b --force → 0 errors.

• devops-guru, mailmanager (6 resources), healthlake, finspace (Environment + kdb), deadline (6 resources), qapps, mwaa-serverless, socialmessaging, s3files

Flywheel: distilled response-parser.ts + rest-json.ts core fixes for the deadline/finspace response shapes; SigV2 already added in E1/E2. wickr (AWS-retired) and nova-act (browser-agent SDK, not IaC) are documented T3 out-of-scope.

T2 coverage is complete: 206 AWS service directories on disk. The full workspace type-checks clean.

T2 full-coverage push — media/iot/ai/comms tail (waves E1+E2, complete, tree type-clean)

The final T2 cluster — 26 more services, combined gate bun tsc -b --force → 0 errors.

• E1 — media + IoT: mediaconvert, mediatailor, mediapackagev2, mediaconnect, medialive, ivs(+realtime/chat), greengrassv2, iotsitewise, iotfleetwise, iot-wireless, iot-managed-integrations, imagebuilder, glacier
• E2 — AI/ML + comms: sagemaker(+featurestore bindings), bedrock-agentcore(+control), bedrock-data-automation, omics, medical-imaging, qbusiness, lex-v2(+runtime), pinpoint-sms-voice-v2, appintegrations, geo-maps/places/routes (read bindings), route-53-domains, simpledb, repostspace

Flywheel output: SigV2 auth added to the distilled core (api.ts HMAC-SHA256 + traits.ts) — classic SimpleDB is the last SigV2-only AWS service, plus a hand-written simpledb module (no Smithy model exists); rest-json/stream fixes for the geo data-plane; generator/protocol coverage for iot-managed-integrations. Entitlement/cost-gated lifecycles (medialive channels, mediaconnect flows, healthlake, omics, qbusiness, chatbot, glacier's deprecated vault API, …) env-gated behind AWS_TEST_* with ungated typed-error probes.

T2 full-coverage push — 54 services (waves A–D, complete, tree type-clean)

Fable fan-out over the 114 T2-deferred modules, ~13 services per wave, each implemented + live-tested + registered, with distilled patched inline for every SDK gap. All four waves green; combined gate bun tsc -b --force → 0 errors.

• A — cheap control planes: resource-groups, resource-explorer-2, schemas, signer, rbin, dlm, fis, global-accelerator, route53resolver/-profiles, service-catalog, oam, synthetics, notifications
• B — data/analytics/gov: lakeformation, databrew, datazone, dataexchange, entityresolution, s3-control, kinesis-analytics-v2, kinesis-video, emr(+serverless/containers), redshift, opensearch, neptune(+graph), dax, docdb-elastic, keyspaces, timestream-influxdb, kendra
• C — security/identity: rolesanywhere, license-manager, cloudtrail, config, network-firewall, acm-pca, directory-service, securitylake, cloudhsm-v2, payment-cryptography, controltower, shield
• D — obs/ops/cost: rum, application-signals, cost-explorer, cost-and-usage-report, bcm-data-exports, internetmonitor, aiops, auditmanager, ssm-incidents/-contacts, service-quotas, backupsearch, pricing, chatbot

Entitlement/cost-gated lifecycles (Shield Advanced, CloudHSM, Directory Service, ControlTower, ACM-PCA, SecurityLake, payment-cryptography, CloudTrail Lake, …) are env-gated behind AWS_TEST_* with ungated typed-error probes proving the distilled union. Flywheel output this push: a distilled generator fix (per-op @http derivation for shared input shapes — deletes were silently issuing GETs), rest-json empty-body + Unit-input + comma-joined-errortype core fixes, and 24 new service error-tag patch files.

Remaining: Wave E (iot/media/ai/comms/misc long tail, ~35 services, split E1/E2).

Wave 1A — serverless test-debt burn-down + quick wins (complete, all suites green)

New coverage

• AWS.SSM.Parameter resource + GetParameter/GetParameters bindings (String/StringList/SecureString, kms:Decrypt composition for WithDecryption)
• AWS.S3.PresignGetObject/PresignPutObject — presigned URLs minted inside deployed Lambdas, verified by real HTTP PUT/GET round-trips (signing seam upstreamed to @distilled.cloud/aws/Presign)
• AWS.KMS.Encrypt/Decrypt/GenerateDataKey bindings (standing test key by alias, kms:RequestAlias-scoped least privilege)
• Live Lambda-fixture binding suites for SQS (5 ops + QueueEventSource end-to-end), EventBridge (PutEvents + consume loops on custom/default buses), CloudWatch (22 of 24 bindings), SecretsManager, RDSData (gated AWS_TEST_SLOW=1, skip-clean green)
• scripts/aws-leak-sweep.ts — tag-scoped stray sweeper (dry-run default; deleted 23 strays from past sessions on first live run)

Bugs found by the live tests and fixed

• DynamoDB Table: pinned-tableName replacement collided with the doomed table and silently adopted it; now deleteFirst replace with wait-until-released
• EventBridge: PutEventsHttp serialized an unresolved Output into IAM policy (MalformedPolicyDocumentException on every deploy); Rule.read crashed the destroy path on unresolved props
• SecretsManager: recreate-after-ForceDeleteWithoutRecovery raced the async deletion
• RDS: Aurora passed vpcSecurityGroupIds to cluster-member instances (AWS rejects); EC2 Network was runtime-unsafe at Lambda INIT (AZ discovery + eager AWSEnvironment)
• Engine Plan.ts: destroy-after-failed-create handed providers unresolved Output expressions; now guarded like the adoption probe (isResolved)
• Engine Binding.ts: BindParameters dropped optional parameters (PutEvents(bus) → "Expected 0 arguments") and truncated variadic parameter lists (GetParameters(...))
• SecretProvider's inlined Effect.retry widened to unknown R in declaration emit, breaking AWS.providers() for every consumer — now an explicitly-typed helper

-// lib/AWS/Providers.d.ts (before)
-providers: () => Layer<..., never, unknown>
+// after
+providers: () => Layer<..., never, ... | Stack | Stage>

Test-harness learnings baked into the suites

• Suites whose tests share one mutable fixture (a queue, a secret) opt out of the global concurrent test execution (describe.sequential)
• Lambda fixtures set explicit timeout (AWS's 3s default kills long-poll routes after the side effect already happened)
• Distilled response-schema patches used inside deployed bundles require a distilled lib rebuild (bundles resolve lib/, vitest resolves src/)

Wave 1B — greenfield flagships (complete, all suites green)

New services (all live-tested end-to-end)

• ApiGatewayV2: Api / Integration / Route / Stage / Authorizer / DomainName / ApiMapping / VpcLink, plus the high-level HttpApi helper (Api + payload-2.0 proxy Integration + $default Route + auto-deploy Stage + invoke Permission in one call), the ManageConnections binding (server-push over WebSocket from a deployed Lambda), and WebSocketEventSource (onWebSocketRoute DX). WebSocket e2e: real wss client connects, Lambda echoes via postToConnection — 4 consecutive green runs.
• Step Functions: StateMachine (auto-created execution role + binding-contract wiring for referenced Lambdas) + Activity, with StartExecution / StartSyncExecution / DescribeExecution / StopExecution / SendTask* bindings. Upstreamed Smithy hostPrefix support to distilled so StartSyncExecution targets sync-states.*.
• Cognito: UserPool / UserPoolClient / UserPoolDomain / Group / ResourceServer + UserPoolAuth/UserPoolAdmin bindings — e2e creates a user, authenticates, and returns a valid JWT through a deployed Lambda.
• SES v2: EmailIdentity / ConfigurationSet (+ event destinations) / EmailTemplate + SendEmail binding (sandbox-gated live send behind AWS_TEST_SES_FROM, ungated typed-error probe).
• Firehose: DeliveryStream (DirectPut→S3, Kinesis source) + PutRecord/PutRecordBatch bindings.
• EventBridge Pipes: Pipe (SQS→Lambda, filtering, enrichment) with typed PipeFailed/PipeStateTimeout — a failed pipe can never hang a deploy.
• Scheduler runtime bindings: CreateSchedule / DeleteSchedule / GetSchedule — a deployed Lambda schedules future invocations dynamically (group-scoped IAM, iam:PassRole contributed by the binding).
• CloudWatch Logs completion: SubscriptionFilter + LogGroupEventSource (a Lambda consuming another function's logs, gunzip/decode handled) + MetricFilter + ResourcePolicy + FilterLogEvents binding.

Engine: isResource now requires Type AND FQN — user prop objects carrying Type (e.g. ASL states { Type: "Pass" }) are no longer mistaken for resources.

Wave 1C — Phase 1 nears complete (8/8 green; run survived a session-limit interruption via workflow resume)

• WAFv2: WebACL (REGIONAL + us-east-1-pinned CLOUDFRONT scope, managed/rate-based/byte-match rules) / IPSet / RuleGroup / WebACLAssociation — associated live to a Cognito UserPool, re-pointed, destroy-order proven. LockToken optimistic-concurrency handled with typed bounded retries.
• EFS: FileSystem / MountTarget / AccessPoint plus Lambda fileSystemConfigs mount support — ungated e2e mounts an access point into a VPC Lambda, writes over HTTP, and proves persistence across a redeploy.
• AppSync: GraphqlApi (multi-auth, async schema creation, cache folded in as a prop) / DataSource (auto-role) / Resolver (JS + VTL, unit + pipeline) / Function / ApiKey / DomainName + ApiAssociation — live GraphQL e2e through a Lambda datasource.
• X-Ray: SamplingRule / Group, Lambda tracingConfig, trace read bindings.
• Bedrock: Converse / InvokeModel bindings with exact model-ARN IAM (foundation models + inference profiles) — ungated live e2e (a deployed Lambda converses with us.amazon.nova-micro-v1:0).
• AI capability set: Rekognition.DetectLabels, Textract.DetectDocumentText, Polly.SynthesizeSpeech, Translate.TranslateText, Comprehend.DetectSentiment — one shared fixture, all live.
• ElastiCache: ServerlessCache + env-only Connect binding (gated lifecycle green in 97s).
• Aurora: the full gated composite smoke is green — 7/7 in ~21 min (Aurora SV2 cluster + Data API + RDS.Connect through a deployed Lambda), skip-clean when ungated.
• Gate: list() added to 13 providers (required by ProviderService; its absence collapses record inference into misleading per-op errors), plus an eventstream decode fix in distilled.

Wave 1D — Phase 1 (Serverless) complete (8/8 green)

• Composite smoke — the Phase-1 exit criterion — passes twice back-to-back: one stack wires Cognito (pool + client), an HTTP API with a JWT authorizer, DynamoDB, S3 presign, an SQS-consuming worker Lambda, and an EXPRESS Step Functions machine; the test signs a user up, mints a JWT via the bindings, exercises the protected todo API (asserting the 401 path never touches DynamoDB), uploads through a presigned URL, round-trips the queue, and gets a synchronous workflow result.
• Distilled gains syntheticErrors: patch-schema support for message-matcher-derived typed error classes ({ name, from, message: exact | includes | matches }), with runtime specialization ahead of base-code lookup and hard-fail orphan detection. Applied to X-Ray (SamplingRuleNotFound, GroupNotFound, …) — the provider now uses plain Effect.catchTag.
• Distilled rest-xml protocol fix: the deserializer now handles Smithy's default <member>-wrapped non-flattened lists (found by Route53 live tests, plus 3 route-53 response-schema patches).
• ElastiCache data plane proven: iovalkey round-trip through a VPC Lambda using the Connect binding (gated, green).
• Cognito triggers DX: preSignUp/postConfirmation/… handlers on alchemy Lambdas (lambdaConfig + Permission materialized automatically); e2e signs up a user auto-confirmed by a deployed trigger. Plus User resource and a risk-configuration typed probe.
• P1 completion sweeps: S3 configs (lifecycle/CORS/website/logging/PAB/intelligent-tiering/replication — 22/22), IAM (GitHub-Actions OIDC federation e2e, SAMLProvider, ServiceLinkedRole, policy version-cap pruning — 36 tests), DynamoDB (resource policy, Kinesis streaming destination, contributor insights), CloudFront (KeyValueStore, Functions, RealtimeLogConfig, CreateInvalidation binding) and Route53 (query logging, VPC association auths).
• Engine fix: Effect-mode Lambdas pin Handler to index.default (a user handler: prop only addresses exports of isExternal modules — previously deployed functions that died at init with Runtime.HandlerNotFound).

Phase 2 (ECS Containers & Fargate) — Wave 2A complete (8/8 green)

• ECS runtime: RunTask/StopTask/ListTasks/DescribeTasks bindings (fixed a real bug sending Effect objects as ARNs) with a live Fargate one-shot-task fixture; standalone TaskDefinition for BYO containers.
• ECR.Image: build+push extracted from ECS/Task.ts into its own content-hash-identity resource (rebuild only on content change) — the dependency Phase 3's EKS ServerHost needs. Task delegates to it; the existing ECS e2e passes unchanged.
• ApplicationAutoScaling (ScalableTarget/ScalingPolicy/ScheduledAction, ECS + DynamoDB), Batch (ComputeEnvironment→JobQueue→JobDefinition + SubmitJob binding), Cloud Map (namespaces/Service + DiscoverInstances runtime binding), App Runner (Service/AutoScalingConfiguration/VpcConnector).
• ELBv2: ListenerRule / ListenerCertificate / TargetGroupAttachment (ip/instance/lambda targets) + ALB event support in the Lambda bridge; flagship ALB→2-Lambda routing e2e green.
• Engine fixes shipped alongside: Resource.ref stables now carry LogicalId (refs usable in host.bind templates); LoadBalancer.delete waits for the ALB to fully clear so downstream subnet/SG deletes stop spinning on ENI release; TargetGroupAttachment retries the AccessDeniedException Permission-propagation race.

Phase 3 (EKS) + Phase 4 (EC2) + engine fix + long-tail L2–L5

• Engine — Platform-in-Platform OOM fixed: yielding a Platform (ECS.Task / EKS.ServerHost / EC2.Instance) inside a Lambda/Worker init program no longer recurses the intercepting ConfigProvider to Runtime.OutOfMemory. The container host bridge read config via Config.string (ambient ConfigProvider = the interceptor → infinite loop); it now reads process.env directly like the Lambda/Cloudflare bridges. Live regression + 364 engine unit tests green.
• EKS.ServerHost (Phase 3 flagship): the ECS.Task analog for Kubernetes — bundles an Effect program to an ECR image, applies Deployment+Service via server-side apply, routes bindings through a pod-identity role. Plus a cross-cutting win: isFunction→isBindingHost across all binding guards so ECS.Task and EKS.ServerHost now light up every AWS binding (previously Lambda-only). EKS Nodegroup + FargateProfile added.
• Phase 4 EC2: EBS Volume/Snapshot/VolumeAttachment + NetworkInterface; VpcPeeringConnection, FlowLog, ManagedPrefixList, DhcpOptions; Auto Scaling ScheduledAction/LifecycleHook + CompleteLifecycleAction binding + lifecycle event source.
• Long-tail L2–L5: bedrock-agent (+ Retrieve/RetrieveAndGenerate), opensearch-serverless, glue, athena, redshift-serverless, s3tables, appconfig, cloudtrail + config.

Long-tail L5–L7 — security/governance, data stores + event sources, devops, AI (landed in worktree)

• Security/governance (account-singleton, capture-and-restore): GuardDuty Detector, SecurityHub Hub, Inspector2 Enabler, Macie2/Detective, AccessAnalyzer + VerifiedPermissions with an IsAuthorized Cedar-authorization binding (a Lambda making authz decisions), Backup (Vault/Plan/Selection), Budgets.
• Data stores + their Lambda event sources (the previously-orphaned ones, now owned): MSK (+ MSK event source), Amazon MQ broker/config (+ MQ event source), DocDB cluster (+ change-stream event source), plus DSQL, Keyspaces, MemoryDB.
• Devops/interop: CloudFormation Stack + CloudControl, CodeBuild/CodePipeline/CodeConnections, Transfer + DMS, ecr-public/account/vpc-lattice/amplify.
• AI + observability: ComprehendMedical/SageMaker-runtime/Transcribe/s3vectors bindings, AMP (Managed Prometheus).
• AppConfig (+ appconfigdata GetLatestConfiguration binding) and CloudTrail + Config landed alongside the Phase 3/4 wave.

Companion distilled PR: alchemy-run/distilled (Wave 1A patches, paginator fix, ValidationException fields, Presign module).

🤖 Generated with Claude Code

[alchemy-version-bot]

Install the packages built from this commit:

alchemy

bun add alchemy@https://pkg.ing/alchemy/fed5c78

@alchemy.run/better-auth

bun add @alchemy.run/better-auth@https://pkg.ing/@alchemy.run/better-auth/fed5c78

@alchemy.run/pr-package

bun add @alchemy.run/pr-package@https://pkg.ing/@alchemy.run/pr-package/fed5c78